Fix: TLS probe on IP targets / 修复 IP 目标的 TLS 探测
- Bug:
check_tls(and thetlsprobe behind it) sent the target address as TLS SNI unconditionally. Modern Node (≥ 20) rejects SNI for IP literals —ERR_TLS_SNI: Setting the TLS ServerName to an IP address is not permitted— so probing any IP target threw instead of reporting the certificate. - Fix: SNI is now only sent for hostnames; IP targets let Node omit it automatically (RFC 6066 — SNI is not defined for IP addresses).
- Regression test: covers both an IP handshake (
127.0.0.1) and a hostname handshake (localhost) against the local self-signed fixture server. - Tooling: added the coverage ratchet gate (baseline 68.02%,
run_tests.sh+.githooks/pre-commit); every code change must bump the version and may not lower coverage.
Test suite: 69 tests green (was 68).